Password protecting a website

Printable View

July 7th, 2005, 10:44 AM
J_K9

Password protecting a website

Hi,

I would like to upload a website to a webhosting company, but as it's still under development I'd like it to have a kind of "member login" on the index, and then from there, if the username and password are correct, they can be directed to the index.html of a subdirectory. I have seen other sites with this kind of pre-release "login required" index, and I'd like to make one. The only problem is that I think I'd need to use something like PHP, of which I know none, or something else. Could someone please point me in the right direction, because I'd like my partners to view the unfinished site to help me with the details. Thanks in advance,

J_K9
July 7th, 2005, 10:59 AM
SirDice

If it's an Apache webserver you can use a .htaccess file..
July 7th, 2005, 11:02 AM
J_K9

I don't think it's an Apache webserver....can you please tell me how to find out? Once, I got a 404 Error which turned it up and I'm pretty sure it wasn't Apache, but how can I check? Thanks,

J_K9
July 7th, 2005, 11:09 AM
SirDice

Ask the hosting company? You can also look at the server headers it returns..

If you're able to use PHP there's a 10 to 1 chance it's Apache..
July 7th, 2005, 11:20 AM
J_K9

Oh ok in that case it isn't Apache because I've just found out for a fact that it doesn't support PHP or Perl "yet" (as they all say). Do you know of any good free webhosting services which support PHP? Well, I guess I have to make the script first...How would I do that? Are there any other languages I could make the script in (as long as it isn't too complicated!). I'm just about to find out what scripting languages they [I]do/I] support. Thanks,

J_K9

edit: Found a list of free webhosting services which support PHP here
July 7th, 2005, 01:05 PM
valhallen

Code:

<?php $pw = "yourpassword"; if($_GET['pw'] != $pw) { die("not authorised"); } ?>

place that code at top of each page you wish to protect
and then when trying to view a url just add ?pw=yourpass onto the end like :

http://yoursite.com/index.php?pw=yourpass

the script basically looks for the password in the URL if it cant find it it stops rest of page from loading and prints an error message. So place the code as the first thing on the page.

Very very very quick and dirty way of doing it - but it works ;)
July 7th, 2005, 01:10 PM
SirDice

No need to use PHP if it is an Apache...

.htaccess is also easy but definitly not a "dirty" trick ;)
July 7th, 2005, 01:29 PM
J_K9

Lol thanks valhallen and SirDice, but could I just get one final thing clear? I have put the php script supplied by valhallen in between the <head> and </head> tages: is this ok? The thing is that I tried it by double-clicking on the index.html file after adding the php script in between the head tags but it loaded up anyway! As I am pretty much a newbie at PHP, I am very sorry for my ignorance, but does this script only work when it's placed on a web server? Also, the web hosting service I have chosen (SiteBerg.com) says that:

Quote:

Using PHP4
You can use PHP immediately after registration.
PHP directives are processed in files with *.php extension. If you want your site to start with index.php, upload it to the server and delete index.html, created during registration.
Store your PHP scripts in the "WWW" folder. Folders with PHP scripts should have "755" ("drwxr-xr-x") access rights, and PHP scripts -- "644" ("-rw-r--r--").

Does this apply to what I have done? I don't think it does because I'm pretty sure that only applies to external php files whereas this is embedded within the html, but I just want to check! ;) Sorry I am very confused :confused: I'm also sorry for being such an ignorant uneducated **** :D

edit: attached is what my index.html currently looks like (if you want to know) - is this right?

J_K9
July 7th, 2005, 02:36 PM
valhallen

you need to inform your server that the file contains content which needs to be processed as php rather than plain html so you will need to change the extension of the page from .html to .php

SirDice : yeah I would prefer to use .htaccess for this kind of thing as well - but am not sure if he has access to it.
July 7th, 2005, 02:58 PM
J_K9

So.....if I change the extension of the page (index.html) ot index.php, and put that in the normal folder (because if I delete the server's index.html I can put my index.php there, as shown in the quote of the FAQ). Will I really need to notify the hosting company, or can I just place this file in the place of the index.html? Also, I'm guessing I'll also need to change the extensions of all the linked pages :eek: lol. Thanks,

J_K9
July 7th, 2005, 03:04 PM
Katja

What's your hosting company that you're using?
Oh, doesn't matter much anyway. With free hosting sites you tend to get what you pay for. In this case you probably have very limited functionality on that site. No Perl or PHP and probably no ASP either. Maybe not even JSP or other server-side functionality. So SSL security either so just assume this website is just unsafe.

If you want to just test your webbuilding skills, install either Apache or IIS on your own system and start hosting your site on your own computer. Then you can play with this a bit more.

In general, free webhosts will prefer to not host websites that have limited access, simply because that would limit the number of visitors. Those free hosts tend to include small advertisements in your webpages because that's where they get their revenue from. Thus they profit more if your site has more visitors. They won't be happy with those secure pages...
July 7th, 2005, 03:26 PM
J_K9

Thanks valhallen! I've set it up on the web hosting site and it works like a charm! ;) Many, many thanks!

Katja: I know how to use Apache (even though I didn't know things like the .htaccess file), but it would be impossible for me to host my own site because my ISP is so crap that my router is disconnected from it at least once a day, for a period of (on average) 30 mins. I think that settles it :D

Oh, the web host is SiteBurg.com and they allow much more than you would think in terms of languages and features. Hell, they even allow MySQL databases! :D Oh, and I don't mind if they kick me off webhosting, because the site's only temporary until I buy a proper domain and have my site hosted by a proper company.

Peace out,

J_K9
July 14th, 2005, 12:17 PM
theorpheus

If your website is develomental stages, then I recommend you use javascript for the time being. Sometimes Javascript can be too revealing if the user looks up the source code.. but there are simple mathematical formulae that could help you disguise your password.. for example..

I used the code below to password protect a website that I was building.

<script>
var pass=new Array()
var t3=""
var lim=8
pass[0]="bW2p8VNKLckHSxp"
pass[1]="LjtBBAPWyzBCVbt"
pass[2]="7PHtDhlEftbicoO"
pass[3]="BBIKGJAB798YA9D"
pass[4]="8gkJSUdqQc0TMmLy"
pass[5]="44gkJSUdqQc0TMmL"

var extension=".html"
var enablelocking=0
var numletter="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
var temp3=''
var cur=0

function max(which){
return (pass[Math.ceil(which)+(3&15)].substring(0,1))
}

function testit(input){
temp=numletter.indexOf(input)
var temp2=temp^parseInt(pass[phase1-1+(1|3)].substring(0,2))
temp2=numletter.substring(temp2,temp2+1)
return (temp2)
}

function submitentry(){
t3=''
verification=document.password1.password2.value
phase1=Math.ceil(Math.random())-6+(2<<2)
var indicate=true
for (i=(1&2);i<window.max(Math.LOG10E);i++)
t3+=testit(verification.charAt(i))
for (i=(1&2);i<lim;i++){
if (t3.charAt(i)!=pass[phase1+Math.round(Math.sin(Math.PI/2)-1)].charAt(i))
indicate=false
}
if (verification.length!=window.max(Math.LOG10E))
indicate=false
if (indicate)
window.location=verification+extension
else
alert("Invalid password. Please try again!")
}
</script>

The password I disguised was 99026189. So when a user enters the right password, it directs the user to 99026189.html
So say for instance you want to use that above code to password protect your main page, your main page has to be named 99026189.html

See what you can do with this..

Also, look up Google.. you may be able to find some auto code generators.
July 14th, 2005, 01:16 PM
Soda_Popinsky

Javascript authentication is so weak it shouldn't even be considered. If your server side script works, use it. If .htaccess files work, even better.
July 14th, 2005, 01:36 PM
J_K9

val's little php script works amazingly, so thanks for the extra suggestion, but I think I'm gonna stick with his (no offence) ;).

J_K9
July 14th, 2005, 01:37 PM
theorpheus

I agree. JavaScript is very weak. But its kinda useful when you dont have too many options and when your website is still in developmental phases. but If you've got any other options available, you should definitely choose them over Java.
July 14th, 2005, 01:40 PM
J_K9

Thanks for the script anyway...I hope you didn't type that out just for me! ;)

J_K9
July 19th, 2005, 10:53 AM
Katja

J_K9, when I meant testing it on your local machine, I really meant it like that too! Doesn't matter if your ISP disconnects you for 30 minutes or maybe even for a whole day. You just install the server software locally and access your own computer locally! You don't even need any Internet connection! It's done all on your local system. At least, that's how I test my own webpages. Try it on your local system by browsing to http://localhost or http://127.0.0.1 or http://YourMachineName or whatever.
If you have two computers and they are connected with a network, you can even install the webhost on one computer and browse to it from the other. You could, for example, an old second-hand computer with not much memory and diskspace, install FreeBSD or Linux on it with Apache and use that one as host for your tests. It only has to be connected to your other system that you'll use to brose to ut.

The biggest advantage? This saves a lot of time uploading all your stuff to this webhost...

Besides, if you want to have a live test with others accessing your site, it shouldn't matter much if it's down even half the time... It's a test, remember?